From 5d542302230fec4edf6443aac25a442b3245306a Mon Sep 17 00:00:00 2001 From: Dinesh Maniyam Date: Tue, 19 Aug 2025 16:35:09 +0800 Subject: mtd: nand: cadence: Fix device assignment to avoid warm reset issue MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The driver currently does: mtd->dev->parent = cadence->dev; This works in Linux because `struct mtd_info` embeds a `struct device`, so `mtd->dev` is always valid and its `.parent` can be set. In U-Boot, however, `mtd->dev` is only a pointer to a `struct udevice`. Dereferencing it before assignment is invalid, which breaks the device hierarchy. As a result, consumers relying on `mtd->dev` (e.g. partition parser, reset and re-init paths) operate on a dangling pointer. This leads to failures during warm reset when the NAND device is accessed again. Fix by assigning the device pointer directly: mtd->dev = cadence->dev; This matches U-Boot’s device model, preserves a valid hierarchy, and resolves the warm reset issue on Cadence NAND. Fixes: ebc41cad ("drivers: mtd: nand: Add driver for Cadence Nand") Signed-off-by: Dinesh Maniyam Signed-off-by: Michael Trimarchi --- drivers/mtd/nand/raw/cadence_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/mtd/nand/raw/cadence_nand.c b/drivers/mtd/nand/raw/cadence_nand.c index 27aa7f97a45..4771440d1de 100644 --- a/drivers/mtd/nand/raw/cadence_nand.c +++ b/drivers/mtd/nand/raw/cadence_nand.c @@ -2196,7 +2196,7 @@ static int cadence_nand_chip_init(struct cadence_nand_info *cadence, ofnode node chip->controller = &cadence->controller; nand_set_flash_node(chip, node); mtd = nand_to_mtd(chip); - mtd->dev->parent = cadence->dev; + mtd->dev = cadence->dev; chip->options |= NAND_BUSWIDTH_AUTO; chip->select_chip = cadence_nand_select_chip; -- cgit v1.3.1 From 6b156c62ced25d3f8aed64c81e471353b56d0f2c Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Thu, 31 Jul 2025 17:21:32 +0100 Subject: mtd: nand: Do not dereference before NULL check In nanddev_init mtd and memorg are assigned values that dereference nand but this happens before a NULL check for nand. Move the assignments after the NULL check. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Signed-off-by: Michael Trimarchi --- drivers/mtd/nand/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/mtd/nand/core.c b/drivers/mtd/nand/core.c index 472ad0bdefb..01ff6e3befa 100644 --- a/drivers/mtd/nand/core.c +++ b/drivers/mtd/nand/core.c @@ -201,8 +201,8 @@ EXPORT_SYMBOL_GPL(nanddev_mtd_erase); int nanddev_init(struct nand_device *nand, const struct nand_ops *ops, struct module *owner) { - struct mtd_info *mtd = nanddev_to_mtd(nand); - struct nand_memory_organization *memorg = nanddev_get_memorg(nand); + struct mtd_info *mtd; + struct nand_memory_organization *memorg; if (!nand || !ops) return -EINVAL; @@ -210,6 +210,9 @@ int nanddev_init(struct nand_device *nand, const struct nand_ops *ops, if (!ops->erase || !ops->markbad || !ops->isbad) return -EINVAL; + mtd = nanddev_to_mtd(nand); + memorg = nanddev_get_memorg(nand); + if (!memorg->bits_per_cell || !memorg->pagesize || !memorg->pages_per_eraseblock || !memorg->eraseblocks_per_lun || !memorg->planes_per_lun || !memorg->luns_per_target || -- cgit v1.3.1